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A realistic Quantum Key Distribution (QKD) protocol necessarily deals with finite resources, 
such as the number of signals exchanged by the two parties. We derive a bound on the secret key 
rate which is expressed as an optimization problem over Renyi entropies. Under the assumption of 
collective attacks by an eavesdropper, a computable estimate of our bound for the six-state protocol 
is provided. This bound leads to improved key rates in comparison to previous results. 
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I. INTRODUCTION 

Quantum Key Distribution (QKD) is a method for 
transmitting a secret key between two partners. Since 
its initial proposal [1] QKD has reached maturity through 
many theoretical developments and experimental realiza- 
tions. Moreover, in the last few years QKD has entered 
the commercial market [2] and small QKD networks were 
realized [3, 4]. 

A significant figure of merit in QKD is the secret key 
rate, i.e. the ratio between the length of the secure key 
and the initial number of signals. There is a big difference 
between the key rate calculated under the assumption 
that the key is composed of an infinite number of bits, 
and a key in real applications, where the number of bits 
is finite. In recent years a new paradigm for security 
in the finite key setting was developed [5-8]. However, 
the complexity of the entropic quantities involved in the 
formalism only permits to find bounds on the optimal 
quantities, which leads to much lower key rates for a small 
number of signals with respect to the asymptotic ones. 

To our knowledge the first work dealing with finite 
key corrections is [9]. The currently used framework 
for finite- key analysis was developed in [6, 7]. The 
bound proved in [7] was used by T. Meyer et al. [10] 
to calculate the key rate in the finite-key scenario. In 
[11, 12] security bounds for the BB84 and the six-state 
protocol were provided using an easily calculable bound 
for the smooth min-entropy. Recently, many efforts 
were done for improving the bounds on the secret key 
rates for a finite amount of resources, e.g. using the 
connection between the min-entropy and the guessing 
probability [13, 14]. So far the secret key rates provided 
are only proven to be secure for collective attacks. A 
possible approach for providing security against coherent 
attacks using the results against collective attacks can 
be obtained by post-selections techniques [15-17] or the 
exponential de Finetti theorem [6]. A recent technique 
is given by uncertainty relations for the smooth min- 
entropy [18, 19]. This last approach is very promising 
because it provides an easily calculable tight bound on 
the key rate even for coherent attacks, however it is not 
easily applicable to the six-state protocol. A step in the 



direction of considering more practical issues in addition 
to finite-key corrections (BB84 with and without decoy 
states and entanglement-based implementations) was 
provided in [20, 21]. 

In this paper, we present a bound on the achiev- 
able key length for the six-state protocol. The presented 
bound is resorted from [7, Lemma 9], where it is used 
for bounding the key length in terms of smooth Renyi 
entropies. We calculate explicitly the presented bound 
under the assumptions of collective attacks and the 
depolarizing channel. The calculated key rates lead for 
small number of signals to better key rates than the 
bounds derived in [10-12]. 

The paper is organized as follows. In Section II 
we present the protocol we are going to study. In 
Section III we introduce definitions and our notation. 
In Section IV we explain the approach developed in this 
paper and we show how to estimate the proposed bound 
for the achievable key rate. In Section V we compare 
the proposed bound with other relevant bounds present 
in the literature. Section VI contains the conclusions. In 
the appendices we prove additional results used in the 
paper. 
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DESCRIPTION OF THE PROTOCOL 
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In this paper we consider the entanglement-based ver- 
sion of the six-state protocol [22, 23]. The protocol con- 
sists of the following steps. 

State preparation and distribution: Alice pre- 
pares N entangled Bell states and distributes one part 
of each pair to Bob. We assume that Eve performs at 
most a collective attack, i.e. the adversary acts on each 
of the signals independently and identically. 

Reduction to Bell-diagonal form: Alice and Bob 
apply randomly and simultaneously one of the opera- 
tors {1, ax, o~y, o~z} and as a result they obtain a Bell- 
diagonal state the entries of which are directly connected 
with the Quantum Bit Error Rates (QBER), [24] and 
Appendix C. 

Sifting and Measurement: Alice and Bob measure 
at random one of the three Pauli operators. The Pauli 
operators are chosen with different probabilities. We con- 
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sider that ax and ay are chosen with the same proba- 
bility and that oz is chosen such that Pr(cr z ) > ¥y(ox )■ 
This biased setting [25] is advantageous in terms of sift- 
ing. At the end of the measurement process, Alice 
and Bob broadcast the choice of the bases through the 
classical channel and discard the results coming from 
a different choice of the measurement basis. We call 
n' = n'x + n'y + n' z the length of the sifted key shared by 
Alice and Bob, where with i — X, Y, Z is the remain- 
ing number of signals when both Alice and Bob measure 

Parameter estimation: Parameter estimation (PE) 
permits to measure the amount of errors on the key, 
which in the security analysis are assumed to be intro- 
duced via Eve's eavesdropping. In the six-state proto- 
col three bases are used for the measurement and there- 
fore a QBER in each direction is calculated by Alice and 
Bob. Practically speaking, Alice broadcasts for each ba- 
sis rrii < n[ bits of the sifted key on the classical channel. 
Bob compares these outcomes with his corresponding 
outcomes and calculates the QBERs e l m as the ratio be- 
tween the number of discordant positions and the length 
of the transmitted strings. In general 7^ 7^ e^. 
For calculating explicitly the bound that we are going to 
propose we use the biggest QBER as measured QBER, 
denoted as e m . Note that it is possible to introduce 
additional symmetrizations [26, 27] that reduce the ini- 
tial state to a state described by only one parameter: 
the QBER. However those symmetrizations require ad- 
ditional experimental means that could be difficult to 
implement. 

The remaining n := n' — mx — mny — rriz bits will 
be used for the extraction of the key. The QBER e is 
bounded by parameter estimation developed in [11, 12, 
14, 20]. The parameter spe represents the probability 
that we underestimated the real QBER. 

The QBER of the key e with probability 1 — spe is 
such that [11, 12, 14, 20] 



e < e r , 
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Error correction: Alice and Bob hold correlated 
classical bit strings X n and Y n . The purpose of an error 
correction (EC) protocol is to create a fully correlated 
string, while leaking only a small amount of information 
to an adversary. In the following, we will consider realis- 
tic error correction protocols. The number of bits leaked 
during the classical communication to an eavesdropper is 
given by [11, 20] 



lcak E c = facnh(e) + log 
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where /ec ^ 1 depends on the used EC protocol, h(e) 
is the binary Shannon entropy, i.e. h(e) = — eloge — 



(1 — e) log (1 — e) and e is the QBER. Here, £ec is the 
probability that Alice's and Bob's strings differ after the 
error correction step. 

Privacy amplification: Let Alice and Bob hold a 
perfectly correlated bit string X n , on which Eve might 
have some information. The purpose of privacy amplifi- 
cation is to shrink the length of X n in order to reduce 
Eve's information on the resulting string. 

Practically, Alice chooses at random a two-universal 
hash function (Definition B.l in Appendix B) and com- 
municates it to Bob. 



III. DEFINITIONS AND NOTATION 

The set of quantum states, which are normalized 
positive semidefinite bounded operators, will be repre- 
sented by S (H), where T-L stands for a finite-dimensional 
Hilbert space. In the following pa{pb) belongs to the 
set of bounded operators which act on the Hilbert space 
H A ('H B ). For a given state pab, the states pa, Pb are 
defined via the partial trace, i.e. pa '■= trg pab and 

Pb ■= to a Pab ■ 

In this paper, we will consider Renyi entropies, which 
are a generalization of the Von Neumann entropy. 

Definition III.l. (Renyi entropies[7, 28]) Let a e R U 
{00} and p, a 6 S {%). The Renyi entropy of order a is 
defined as 1 



S a (p) 



In particular, we get 



1 



log(trGO). 



S (p) 

s 2 (p) 

#00 0) = -log(A max (p)) 



log (rank(p)) 
-log (tr(p 2 )) 



(4) 



(5) 
(6) 
(7) 



where A max (p) is the maximal eigenvalue of p. 



Another useful quantity is the smooth Renyi entropy, 
which is the Renyi entropy optimized on a set of operators 
which are e-close to the operator involved in the actual 
computation. We define an e-environment via the trace- 
distance in the following way [7]: 



Definition III.2. 

S(H), then 
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Definition III. 3. The smooth Rcnyi entropy of order a 
is defined (following [7]) as 

S£(p):=_L- inf log(trK)). (9) 

1 - a aeBi(p) 

The main result presented in this paper will be 
expressed as an optimization problem on a classical- 
quantum e- environment of a certain operator. 

Definition III. 4. (Classical-quantum(cq)-state) Let 
{\x)} be an orthonormal basis of H x and moreover let 
rl A be a generic Hilbcrt space. We define the state pxA 
which is classical on % x and quantum on ~K A as the state 

Pxa = P x( x ) \ x ) ( x \ ® P% 

X 

where p\ G S(H A ) and P x (x) is a classical probability 
distribution. 

Finally, we define the classical- quantum e- environment 
as the space 

#cq (pxa) ■= Wxa G S £ (pxa) : 

o-xa = ^2p x (x) \x) (x\ ® cr^}, 

where er^ G S(H A ) and Px(x) is a classical probability 
distribution. Finally, we recall the composablc definition 
of security introduced by Renner in [7]. For additional 
details see [29]. 

Definition III. 5. Let pke be the cq-state describing 
the classical key K of length £, distilled at the end of a 
QKD protocol, correlated with the quantum states of the 
eavesdropper p^. The state pke is sa id to be £-secure if 

\\\pKE-^l®pE>\\i<e, (10) 

where pe< is the quantum state of an eavesdropper not 
correlated with the key. 

In the literature several bounds on an e-secure key 
length [6, 7, 30] were presented. 

IV. BOUND ON THE ACHIEVABLE KEY 
LENGTH 

The following bound was inspired by [7, Theorem 4] 
where it was used as a bridge for providing an analogous 
bound in terms of smooth Rcnyi entropies. 

Theorem IV. 1. Let px™E n be the cq-state describing 
Alice's bitstring X n as well as Eve's quantum informa- 
tion represented by pe™- Let e,epA > 0. If the length £ 
of the key is such that 

£< SUp (S 2 (<TX n E») - S (<7En)) 

-leak E c + 21og(2e FA ), (11) 
then the key is e + spA-secure. 



Sketch of Proof: In the following we give an idea of the 
proof which follows the lines of [6, 7]. For all details see 
Appendix B. We first prove that £ can be chosen such 
that 

£ < sup (S 2 {o-x^e^c) - S (a E nc))+ 

+ 21og(2e PA ), (12) 

where the additional random variable C is associated 
with the probability distribution of transcripts of the EC 
protocol. Then we will "extract" the leakage term using 
the data processing inequality and the subadditivity of 
the Renyi entropies. □ 
The bound in Eq. (11) is related to the bound calcu- 
lated in [10] because it involves optimizations on Rcnyi 
entropies. However, in [10] the two Renyi entropies are 
optimized independently and here we have a combined 
optimization problem. This additional constraint is mit- 
igated by the fact that in our bound we optimize over a 
bigger environment than the one used in [10], more pre- 
cisely e' = %- where e' is the environment used for the 
smooth Renyi entropies in [10]. 



A. Lower bound of Theorem IV. 1 using smooth 
Renyi entropies 

In this section, we present a lower bound for the key 
length presented in Theorem IV. 1. The optimization 
problem involved in equation Eq. (11) is exponentially 
complex because the dimension of the involved operators 
scales with n, that is the length of the string used for 
extracting the key. For reducing the complexity of the 
problem we consider the symmetric six-state protocol. 
For this protocol the number of different eigenvalues in 
p x n E scales polynomially with n [10], therefore as done 
in [10], it is possible to concentrate on optimizing the 
eigenvalue distribution of o~x n E n - However it is not clear 
how to find the eigenvalue distribution of <jE n from the 
one of ax^E" in such a way that it is possible to per- 
form computations for big n. In the following we present 
a lower bound on Theorem IV. 1 expressed in terms of 
the smooth Renyi entropy of order zero and a modified 
smooth Renyi entropy of order two that we will denote as 
SziPxls)' This last entropy permits to bound the eigen- 
values of o E n for a given ox n E n - From the numerical 
point of view the deviation from Sf (p'xe) 1S negligible. 



1. Modified Smooth Renyi entropy of order two 

Let p x n E be the operator describing Alice's classical 
string of n bits correlated with the operator / o 1 | n held 
by Eve. The operator p x n E is constructed by a direct 
sum of 2™ blocks which have the same eigenvalues (see 
Appendix C for additional details). 
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Definition IV. 2. The modified smooth Rcnyi entropy 
of order two of the operator p x n E is defined by 

SI(pTe) ■■= S2(T XnE n), (13) 
where the operator tx •» E n has the following properties: 
1. tx'ie™ has the following form 

2" -1 



rx"_E" := 



2 n J 

x=0 



X) (X (X) T 



E"i 



(14) 



where {\x)} is the basis in which p x n E is a classical- 
quantum state (Definition III. 4). Moreover each of 
the \r En } has the same eigenvalues and the depen- 
dence on x is manifested only in the eigenvectors 
(See Eq. (D4) for a more formal statement). 

2. Let {Aj}i = o ; ... ;rl +i be the set of differing eigenval- 
ues of one block of the operator p x n E m increasing 
order; i.e. < A^+i and let {m,}, = o,...,n+i be the 
set of multiplicities such that to,; is the multiplicity 
of A;. Let {ni}i=o,...,n+i be the eigenvalues of one 
block of tx" E n hi increasing order with respective 
multiplicity {n^l^o,. ..,«+!• Let 



s r '■= £ m "-'+2(A n _. i+2 - A„_ r+ i), (15) 

(16) 



for < r < n+ 1. 

The eigenvalues of tx™ e™ are defined by the follow- 
ing relations 



where 



and 



A + n + 1 - b+ < i < n + 1 
A, 1< i < n - b + 



2mo 



i = o 

1< i < n + 1, 



6 + := max{r : s+ < — } 



A+ A„_ b++1 



s b + 



(17) 



(18) 



(19) 



Since the smoothing in the smooth Rcnyi entropy of 
order two is realized by taking the maximum in the envi- 
ronment, it follows for any operator ax™E n <£ B^{Pxe) 

SUpTe)>S2(Wx^e^. 

Therefore, if we can prove that the operator rx« E n in- 
troduced before is such that tx^e^ & &^(Pxe)' then we 
have proven that the modified smooth Rcnyi entropy is 
a lower bound for the smooth Rcnyi entropy 



Proposition IV. 3. The operator tx" e*> defined by its 
eigenvalues in Eq. (17) is such that \\\rx^E n ^ PxeW = f • 
i.e., tx^e^BHpTe)- 

Proof. The proof follows by the direct calculation of the 
distance using the spectral decomposition of p x n E - '-' 



For the six-state protocol for n = 10 , it turns out 

that 2 \S £ 2 (pTe) ~ SI(pTe)\/SI(pTe) « 10" 5390 for a 
QBER = 5% and e = 10 16 . Moreover, for increas- 
ing n the difference becomes smaller. The reason of this 
similarity is that the dimension of the kernel of p x n E is 
much bigger than the degeneracy of the support, namely 
mo = 2 2n — 2™ vs Yli&a mi = ^'N therefore there is, prac- 
tically, no difference between the eigenvalue distribution 
in Eq. (17) and the optimal eigenvalue distribution for 
S^pTe) Presented in [10]. 



2. Computable lower bound for the achievable key length 

The following theorem provides the bound that we are 
going to exploit in this paper. 

Theorem IV. 4. Let p x n E be the cq-state describing the 
classical string shared by Alice and Bob and the correlated 
quantum state of the eavesdropper. Then 

sup [5*2 (o~x n E n ) - So(cr_En)] > 

sT i (Px n E)~sUpT + ~SE^-e 

with Se" = 2^+1 1-E" and < e < e. 

Proof. In order to provide a lower bound, it is enough 

to choose an operator in Bc^Pxe) an d to calculate 
the difference between the Renyi entropies of the cho- 
sen operator. In Appendix D we construct an operator 

T]x n E n S Bi q (p XE ) such that the following two inequali- 
ties hold: 



and 



where Se™ 



S (r,En)<Sl(pT + 6 En ), 



2'in+i *E n ■ 

Using these two inequalities, we have 



sup 



[S 2 (CTX' 



E"j 



"5*2 (j]x n E n ) - S (r) E ™) > 

sT s (pTE)-sl(p E n + s B ^ 



(20) 



(21) 



(22) 

(23) 
(24) 
□ 



2 The high precision used in this calculation is obtained using an 
arbitrary precision computer program (See Section V). 
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Remark IV. 5. Numerical calculations indicate that the 
choice e. = | is optimal for a wide range of used param- 
eters. 

Remark IV. 6. The bound provided in Theorem IV. 4 
may not be asymptotically optimal. However, the em- 
phasis is for finite-key analysis and the bound permits to 
improve the key rate for experimentally relevant number 
of signals. Note that although we can have small dif- 
ferences in the asymptotic case, the bound is, from the 
numerical point of view, pretty tight. In fact, note that 
(see Definition III. 3) 



sup 



<sUpTe) 



Calculating the difference between the upper bound 
and the lower bound, it is for small n (n ~ 10 4 ) of the 
order of 0.1% and it decreases for larger n. 



V. RESULTS 

The security is characterized by the parameter e, rep- 
resenting the acceptable probability of failure of the ex- 
ecution of the protocol. In the following we consider a 
standard setting with e = 10~ 9 . For the simulations we 
assume that n' x = n' Y and we take for parameter esti- 



mation mx = my = vtiz 



The length of the string 



used for the extraction of the key is n = n' z — mz which 
has at most QBER e = e m + 2((epe, mz) with probabil- 
ity 1 — epe (see Eq. (1)). The error correction protocol 
performs such that in Eq. (3) we have Jec — 1-2 and 
sec = 10~ 10 ([12], Eq. (3)). Finally, we optimize the 
free parameters (epE,£, £pA,Pr(o~x),n) in order to max- 
imize the key rate. 

The algorithms for the calculations were implemented 
using C++. The library CNL (Class Library for Numbers) 
[31] was used to perform calculations with arbitrary pre- 
cision. Due to the non-smoothness of the involved func- 
tions, we used the Hybrid Optimization Parallel Search 
PACKage HOPSPACK [32], which permits to deal with 
all involved optimizations in an efficient way and permits 
to perform the calculations on a cluster. 

In the following we summarize the three bounds for the 
achievable secret key rate that we are going to compare. 



and Bob, n be the length of the string used for extract- 
ing the key which has QBER e = e m + 2Q(epE, mz) with 
probability 1 — £pe- Then Alice and Bob can achieve the 
secret key rate 



n 

~N 



SI(PTE)-Sl{p% n + 5 E -) 



leak 



EC 



+ 2 log (2e PA ), 
where £ = £pe + £pa + £ + 



e=e m +2Q 

(25) 



-^EC- 



Proof. Using Theorem IV. 1, Theorem IV. 4 and Re- 
mark IV. 5 the result follows. □ 



Asymptotic Equipartition Property (AEP) bound 

The conditional smooth min-entropy [6] characterizes 
the optimal secret key rate [6, 18]. The AEP bound used 
in [12, 14] comes from the AEP approximation [6, 33] of 
the conditional smooth min-entropy. Collective attacks 
allow us to bound the smooth min-entropy of a product 
state by the conditional von Neumann entropy of a single 
state [11, 14] 



taep 



H{X\E) p -5 



Iog(2/e) 



leak 



EC 



21og(2£ Pj4 ), 



e=e m +2C 

(26) 



with H{X\E) p = (1-e) 



1 - h 



l-e 



Smooth Renyi entropy bound 

This bound was derived in [7] and calculated in [10] 
and is given by 



rsRE := 



where e' 



N 



Si {pTe)-S s o (>!")- leak EC 
+ 21og(2ep A ), 



e=e m +2C 

(27) 



Bound proposed in this paper 

The following proposition summarizes our results of 
Section IV. 

Proposition V.l. Let p^ E be the cq-state describing the 
classical string shared by Alice and Bob which is corre- 
lated with the quantum state of the eavesdropper. Let N 
be the initial number of quantum states shared by Alice 



A. Robustness of the protocol 

An important figure of merit is the threshold QBER 
which characterizes the minimal N for a fixed QBER per- 
mitting to extract a positive key rate. As shown in Fig. 1, 
with the bound presented in this paper it is possible to 
have a positive key rate with 23% signals less than the 
smooth Renyi entropy bound and 50% signals less than 
the AEP approach, for a QBER of 1%. 



6 



6.6 



6.4 - 




4.6 1 1 1 1 1 1 1 1 1 

0.01 0.02 0.03 0.04 0.05 0.06 0.07 0.08 0.09 

QBER 

FIG. 1. (Color online) Minimal number of signals versus 
QBER permitting to extract a non-zero key rate. Compari- 
son between the bound presented in this article r (black solid 
line), see Eq. (25), the smooth Renyi entropy bound tsre 
(blue dashed line), see Eq. (27) and the AEP bound taep 
(red dot-dashed line), see Eq. (26). 



B. Secret key rates 

In Fig. 2, we compare the secret key rates calculated 
by the three approaches for various QBERs. The bound 
developed in this paper leads to significant higher key 
rates when limited resources are used. In particular when 
QBER = 1% with the bound presented in this paper 
with ./V rj 5 • 10 4 , it is possible to have non-zero key 
rates. Instead with the other approaches it is necessary 
to use N ss 6.5 ■ 10 4 for the smooth Renyi entropy bound 
and TV « 10 5 for the AEP bound. 




5 5.5 6 6.5 7 

Log 10 N 

FIG. 2. (Color online) Key rate versus log 10 (A r ) where N is 
the initial number of quantum systems shared by Alice and 
Bob. Comparison between the bound presented in this article 
r (black solid line), see Eq. (25), the smooth Renyi entropy 
bound tsre (blue dashed line), see Eq. (27) and the AEP 
bound taep (red dot-dashed line), see Eq. (26). 



VI. CONCLUSIONS 

Although optimal bounds for the finite-key scenario 
are provided in the literature they are not calculable and 
were so far only estimated by bounds coming from the 
asymptotic cquipartition theorem (see [14, 19] for two ex- 
ceptions). In this paper we resumed the smooth Renyi 
entropy bound [10] and we proved that this bound is 
tighter than the AEP bound. Our main contribution 
is a new bound on the maximal achievable secret key 
length which involves optimizations on Renyi entropies. 
With respect to [10] the main advantage is that we use 
a bigger environment for the optimizations and with re- 
spect to [11, 12] we don't use bounds coming from cor- 
rections to the asymptotic case. As a result we were able 
to obtain higher secret key rates with respect to [10-12]. 
For calculating the quantities involved in our analysis we 
need the quantum channel to be symmetric. Although we 
don't have any guarantee that Alice and Bob share such 
a channel, it is possible for them to reduce to this case 
employing additional symmetries 3 or taking as QBER of 
a symmetric channel the worst one of a non-symmetric 
channel. 

Finally, regarding future work, note that here we con- 
sidered an ideal protocol where the signals entering in 
Alice and Bob's laboratory are qubits and where the mea- 
surement devices are perfect. All this assumptions could 
be relaxed following the analysis done in [20, 24]. 
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Appendix A: Properties of Renyi entropies 

The following properties and their proofs can be found 
in [5] and [34]. 

Lemma A.l (Data processing). Let e,e' > and 
Pxbc G S (% x ® H B ® W c ) be a classical-quantum 
state, i.e. pxbc = J2 x ex p x(x)\x)(x\ <g> p x B ® p x c . Then 
with S 2 (pxc\X) := vn.f x! zx S 2 (pxc\x), the following in- 
equality holds 

S £ 2 +e ' (pxbc) > Si' (p xc ) + SI ( P xb\X) . (Al) 



3 Actually, in this case it also possible to redefine the protocol 
removing the sifting following the construction presented in [27]. 
The key rate will be higher but the relative differences between 
the three approaches remain the same. 
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Lemma A. 2 (Subadditivity) . Let e > 0,e' > and 
p AB eS(H A ®H B ), then 



S S o +£ (pab)>S^( Pa ) + S £ (p B ). 



(A2) 



Appendix B: Proof of Theorem IV. 1 

Before we start with the proof, we define some quan- 
tities used in the following. 

Definition B.l. (Two- universal hash functions [35]) Let 
T be a family of functions from X to Z and let Pp be a 
probability distribution on J 7 . The pair (_F, Pp) is called 
two-universal if Pf [f(x) — f(x')} < for any distinct 

x, x' G X and / chosen at random from T according to 
the distribution Pp. 

The following definition involves the leakage of infor- 
mation during the error correction protocol. 

Definition B.2. The number of bits leaked to an eaves- 
dropper during the error correction protocol is [6] 



leak 



EC 



log|C | 



inf S„ 



P 



C\X"-- 



(Bl) 



where \C\ is the cardinality of the set C containing all 
possible communication transcripts and Pc\x n =x n is the 
probability that there is a specific communication tran- 
script when Alice has a specific x n . 

Note that in the definition Bob is missing because we 
consider a one-way error correction protocol. 

Moreover, let us recall a result proven in [7] and used 
in the following proof. 

Theorem B.3. [7] Let px™E™c be a cq-state describ- 
ing Alice's bitstring X n , Eve's quantum system and the 
distribution of error correction transcripts C . Let T be a 
two-universal family of hash function from X n — > {0, 1} . 
Then 

1 



■^\\PF(X^YE l CF~PU ® PE e CFh 



< }_2~?( S 2(Px™ E"c)-S (p E "c)- 

~ 2 



(B2) 



where Pf(x™Ye'cf ■= E/e^ p F(f)Pf(X"YE e c ® l/X/l 
and pu — Tp-1. 

Now we are ready to prove Theorem IV. f. 

Proof. (Theorem IV. 1) At the end of the QKD protocol, 
the classical string obtained from privacy amplification 
correlated with Eve's information is 

Pf(x™Ye c cf ■= X! p ^U)Pf(X"YE t c ® l/X/l- 

Let P F ( X ny E t C F e K * {pf(x^ye^cf) be the operator 
that maximizes the right-hand side of Eq. (B2). Because 



the trace-distance does not increase applying the partial 
trace, it follows that p' E e CF € {pe'cf)- Let us define 
Pit = il. Then, 



2 \ \PF(X"YE e CF - Pu ® Pe 1 cf\\ 1 

l \\ 

2\\PF(X^) e E t CF - PF(X"YE e CF 

+PF(X") e E>CF — PU ® P'e'CF 

-pu ® Pe'cf + Pu ® P e ^cf\W 



„e 1 
< 2- + - 

- 2 2 



Pf{X"-ye c cf — Pu ® Pe'cf 



(B3) 
(B4) 



1 -f I sup j [S 2 ( cr X»Bno)-S , (cr B n c ,)]-^ 

<f J 2 \ < T A'"E™C eB ^('>X™E™c) / 

- 2 

In the step from Eq. (B3) to Eq. (B4) we used the tri- 
angle inequality and the fact that the maximal possible 
distance is |. The last inequality follows from Eq. (B2) 
and the definition of p'pi X ny E ic F - Requiring that the 
distilled key is (<?+ £pyi)-secure, i.e. 



1 — f I sup - [S 2 ("x» E"c)-S (<y E "c)]- 

2 

! 

<£ + £pA, 



the proof of Eq. (f 2) is completed. 

Regarding the leakage term, note that in order to apply 
Lemma A.l of Appendix A for bounding S 2 (o~x n E n c) we 

restrict the optimization space to Bcq (px™E™c)- There- 
fore, 

sup (S 2 {o- X "E"c) - S {o- E nc)) > 

SUp (5 2 {0- X n E n C ) ~ S {<T E n C )). 

e 

Using Lemma A.l of Appendix A with e = s' = 0, it 
follows that 

S 2 (o-x^e^c) > S 2 (o*» B ») + S 2 (a x »c\X n ). (B5) 
By definition 

S 2 (a X n C \X n ) := mf x S 2 (P C |X"=*») (B6) 

Moreover, using Lemma A. 2 with e = e' = we obtain 
S (a E n C )>S (a E n) + S (a c ). (B8) 

Putting together the last four equations and Defini- 
tion B.2 the proof is concluded. □ 
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Appendix C: The operator pxE 



The Bell-diagonal state shared by Alice and Bob after 
the use of the depolarizing map is 

Pab = A 1 |V> + )(V + |+A 2 |0(V>-| 

+ a 3 |0+) (</> + | + A 4 |<r)(<r|, 

where the states ) ,\<f> )} are the Bell states and 
E,Ai = l. 

For the symmetric six-state protocol 



A 



-(2-3e), A 1= A 2 



A, 



(CI) 



where e is the Quantum Bit Error Rate (QBER). 

The operator pabe is defined as the purification of 
Pab- Tracing out Bob and measuring Alice's system, we 
get the operator p XE describing the classical string X n 
held by Alice and Bob and Eve's quantum systems p% n ■ 
In general 



Pxe 



(C2) 



p o_ Ap + Aj 



Ao+Ai 
An 



Ap VAqAi 
o_l Aq+Ai Aq+Aj 



Ao + Ai 
A 3 



Ao+Ai 



r n — 



A 2 ~t~^3 

v / A 2 T 3 " 



A2+A3 

A 2 



A2 + A3 A2 + A3 
Ai /AqAi 



/ApAi 



Ai 



A o + Ai Ao + Ai 
VAp Ai Aq 
Ao+Ai Ao + Ai 

/ A3 V A2 A3 
A 2+A3 A2+A3 

I VA2A3 A 2 



,iv= 



Ao+Ai An + Ai / 

A2 V A2 A3 > 
A 2 + A3 A2 + A3 

V A2 A3 A3 
A2+A3 A2+A3 / 

Va^aT" \ 



Ao 



Aq + Ai 
_ VAp Ai 
An + Ai 

/ A 2 



Ao + Ai 



A2 +A3 
_ V A 2 A3 



V^2 A3 
A2+A3 

A, 



V A2+A3 A2+A3 / \ A2+A3 A2+A3 

For the following, it is convenient to define 

1 



Pi 



2^ " 

x=0 



(C8) 



with i = 0,1, 2, 3. As can be easily verified the operators 
{Pi} are diagonal in the basis where the operators {P? } 
assume the form given above. 



with 



P°E 



PE 



( Aq 



vAoAi 



Ao 



\/AoAi 
Ai 





— VAoAi 





\ 



A2 V A2A3 
VA2A3 A3 / 




A 2 



(C3) 



— V A0A1 
Ai 

A 2 — VA2A3 

— VA 2 A3 A3 



(C4) 



Diagonalizing the operators above, we find that they 
have the same eigenvalues but different eigenvectors, i.e. 



Pe 



where the eigenvalues {r^ 1 } are 

r d) _ r (i) _ 

1 — 1 2 — U, 

r 1 ] 1 = Ao + Ai, 

if > = a 2 + a 3 , 



(C5) 



(C6a) 
(C6b) 
(C6c) 



and the operators {Pf} are projectors on the eigenspace 

of the eigenvalues {r^ 1 -*} obtained by diagonalizing p x E . 
From the diagonalization it is possible to derive explicitly 
the projectors: 4 



4 Let us define O2 as the 2x2 matrix with zero entries. 



Appendix D: Additional details of the proof of 
Theorem IV.4 



Before to start, it is necessary to fix the notation for 
the involved operators. The operator p x n E can be written 
as 



2™-l 



2 ^"-i 



(n) D (ra)a: 
i ! 



x=0 



i=0 



where 



n-l 



p=0 



r <»> := jj r w 

p=0 



(Dl) 

(D2) 
(D3) 



and i := Ep=o 4 % Wltn V = 0, ...,3, x := 2P;e p 



where x p is a binary digit. 

The operator p XE is constituted of 2™ diagonal blocks 
labeled by the index x. Each of the blocks has 2 2 ™ eigen- 
values and each eigenvalue is associated to a projec- 
tor P^ x that depends on the eigenvalue (index "i") and 
on the block (index "x"). 

1. Construction of the operator r\x n E™ 

The operator r\x n E n is constructed in such a way that 
the inequalities in Eq. (20) and Eq. (2f) arc satisfied. 
For constructing rjx^E n we construct first r) E n using the 
following two steps: 
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1. Find r X n E n such that S 2 {t x »B") = ^2 £ (p1b) 

2. Find ?7x™£™ such that S (ve™) = <So( T £™)- 

By definition of smooth Renyi entropy of order two 
tx n E n G Bcq~ (Pxe) an< ^ ^ can ^ e wr itten as 



TX"E" 



2™ ^ 

x=0 



\x) (x\ ® 



\ " ^.{n) p{n)x 



i=0 



(D4) 



Regarding the operator r^n, the constraint on its 
Renyi entropy of order zero is only a constraint on its 
eigenvalues. For assigning a well defined structure of op- 
erator to rjx™ E n we use rx» e™ ■ Let II be the projector 
that cuts out the eigenvalues of t E " such that their sum 
is e/2. 

The operator rjx" E" , is defined by 



1 



-(l xn ®n)rx»s»(lx»®n). (D5) 



This definition is such that r\ E n = T-^-rTlT E nIl has the 

2 

eigenvalues for respecting So^fi™) = <So( T £™)- 

Finally, note, that the construction above, although 
arbitrary, is legitimate because, as it is easy to verify, 

»?x™ E" G S C q (pxe) as required by the statement of The- 
orem IV. 4. 



2. Proof of Soivsn) < Slip®," + 

In order to find the claimed bound, we need to find a 
bound on the eigenvalues of the operator t E " ■ In order 
to do that, we exploit the definition of rx« E n , Pxe an< ^ 
of modified smooth Renyi entropy of order two (Dcfin- 
tion IV.2). 

We introduce the operator 5 X n _e™ defined by 



X — ®n 

ox™e™ ■= tx™e™ — Pxe- 



(D6) 



Let fen := tx E n(8 X n E n), t~e™ ■= tx E n{r X n E n) and let 
{|Z)} be a basis of eigenvectors of the operator t e ^. The 
eigenvalues of te» are 

(l\T En \l):=(l\p® n \l) + {l\6 En \l). (D7) 

The operator p® n is fully characterized by the protocol 
[10]. In order to complete the proof, it remains to bound 
(1\6e»\1). 

The following lemma permits to reduce the analysis to 
the eigenvalues of 5 E n. 

Lemma D.l. Let p x n E ^ T x n E n be the operators described 
by equation (Dl) and (D4). Then 

[T E n,p% n ]=0. 



Proof. By definition 

2 n -l 2 2 ™-l 

1 

T E 



2 —1 



2™-l 



= _L V V r^M™)* - V r (n) 1 V p 

On 1 1 Z-~t * I On 1 



(n)x 



x=0 i=0 



Observe that the operator in the brackets is diagonal, in 
fact: 



2 n -l n-l 



— \ " p^ x = — fi?) p Xp 

2=0 2=0 p=0 

4EE- E (8K 

=0 ki=0 

1 1 

-Yp x 



11 1 n-l 



xo— Oii-O s n _i-0p-0 
n-l 1 



p=0 \ x=0 / 



1 Pi. 



p=0 

Due to the diagonality of the operators {P, }^ =o,...,3 and 
the fact that the tensor product of diagonal operators 
lead to a diagonal operator, the assertion is proved. □ 

The next lemma, permits to relate the operator 5 E to 
the operators Pj defined in Eq. (C8). 



Lemma D.2. It holds 



e — e 



S E n = (1 - (P + P 

2m 



where the operators Pi are defined in Eq. (C8), P^ = 
Co P % andV:={i:T\ n) ^0}. 

Proof. Using the eigenvalues in Eq. (17) and Eq. (D6), 
Eq. (D4) 



S E n := tT Xn (5 x *>E") 

o» 1 

e — i 1 



2m 2" 



E 

x=o iev 1 - 

^rEE^ 

x=0 i£V 



(n)x 



(n)x 



The quantity ^2 ieV ± p^ n > x i s such that 



i 

£pf)* = i-£p( 



From equation Eq. (D3) and Eq. (C6), we see that the 
non-zero eigenvalues of p XE are characterized by the ab- 
sence of the index i p = 0,2. Therefore, it follows that 

n-l 

£pp (D = 2) E(8)< P 

i£V iGV p=0 

n-l 

= (g)(Pl Jp +P?)- 

p=0 
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By taking the sum over all blocks and using the operator Substituting in the formula above the actual values for 
defined in Eq. (C8) the statement of the lemma follows. the symmetric six-state protocol provided in equation 

□ (CI) the proof is concluded. 



Using the previous lemma we can prove the most im- 
portant result of this section. 

Proposition D.3. For \q > | and Xi = X2 = A3 the 

following inequality holds: 



(l\ S E » 10 < I 



Ai 



(D8) 



2m \ \ Ai + A 
where {\l)} is a basis of eigenvectors for the operator p^J 1 
Proof. 



(l\ 5 E « |0 < —max (Z| (1 - (P 1 + P 3 )®«) \l) + 
2m {\i}} 



e — e 



Ai 



1 - 



2m V V Ai + Ao 

+ $><i|if ) |i> 



(D9) 



where V := {i : ' 7^ 0}. Since the 5i are negative or 

zero and the operators Pj- n ' are such that Pf' > 0, the 
last term in Eq. (D9) is negative and then the proposition 
follows. □ 



Concluding, using Proposition D.3, it is possible to give 
an upper bound for Sq(te^), in fact 



(l\r E «\l) = (l\p% n \l) + (l\5 En \l) 



<{l\p% n \l) + 



2mo 



Ai 



Ai + Ao 



(D10) 



3. Proof of 5 2 (?7x"b™) > S% " (p%" E ) - i 
Using Eq. (D5), it follows that 



X™E" 



log 



tr XnEn ((1 <g> IL)t x ™e* (1 <8 II))' 



11— — 



+ 



Using the first requirement in Definition IV. 2, the op- 
erator Tx n e*> is of the form 



2™-l 



TX"E" 



in © T E r 



x=0 



We concentrate on the argument of the logarithm in 
the first term on right-hand side of ^(tx^B") 



trjf"_E« 



((i®n)Tx«s»(i®n)y 

'2"-l 



tr X "E" 



tr B r, 



Ut^IT 



® ( 2 > 

x=0 V 



= tr ^ 

x=0 
2 n -l 

< £ tr £ , 

x=0 
= tl'X"_E" 



-Ur* n 



(t x »e»Y 



Taking the first term of the Maclaurin expansion of 
log(l — §) for e small, we conclude that 

Si (r]x n E n ) > S 2 (t x ^E") - e. 
Using Eq. (13) the proof is concluded. 
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